Opening a branch or selling online: PCI DSS again
What changes in a shop's PCI DSS obligations when it opens another branch or starts taking card payments online, and who to ask about validation.
By Achekam · · 5 min read · For Retail businesses in South Africa, Nigeria, Kenya
The second shop is signed, the shopfitters are booked, and the owner has ordered card machines for the new tills. At the same time, a website developer is building an online shop so customers can buy the bestsellers without visiting either branch. Somewhere in the stack of paperwork is the annual card security questionnaire from the bank, completed last year for one shop with one card machine.
That questionnaire described a business that no longer exists. Card security obligations follow how a business takes cards, and opening a branch or a website changes that. This article explains why growth is a reason to revisit the Payment Card Industry Data Security Standard, what changes with each new channel, and who decides what the shop must do.
A standard you meet every year, not once
Stripe's guide to PCI compliance states that PCI compliance is not a one-time event but an annual process. It advises checking and revalidating when the business adds anything new that involves card data, such as physical stores, new markets or a customer support centre.
It is easy to think of PCI as a form filled in once, when the bank installed the first terminal. In practice, every year's validation should describe the business as it is that year, and any new way of handling card payments in between is a reason to look again before it goes live, not after.
What each kind of growth changes
Different kinds of growth raise different questions. A short way to think about it:
| Change | Questions to ask |
|---|---|
| A new branch with card machines | Are the new terminals from the same provider? Who has access to them? Are they on the same network as other equipment? |
| Taking card payments online | Which provider takes the payment? What does the website do, and who looks after it? |
| Taking card details by phone | Who hears or writes down card numbers, and where does that information go? |
| A new country | Is there a new acquirer, and does it have its own requirements? |
The answers do not just tick a box. They determine which version of the self-assessment applies, if any, and what the shop must do to keep each new channel safe.
Levels and transaction volumes
Stripe's guide explains that there are four PCI compliance levels, typically based on the volume of card transactions a business processes in a 12-month period, and each level carries different validation requirements.
At the top, it states that Level 1 covers organisations that process more than 6 million Visa or Mastercard transactions a year, or more than 2.5 million American Express transactions, or that have experienced a data breach. Level 1 businesses cannot use a Self-Assessment Questionnaire and must complete an annual Report on Compliance, which the guide says is signed by a Qualified Security Assessor or the merchant's executive officer, with a quarterly network scan by an Approved Scanning Vendor.
An independent shop is unlikely to be anywhere near Level 1 volumes. But two points matter for a growing business. First, adding a branch and a website adds transactions, and the total across all channels is what counts towards the level. Second, the breach criterion is not about size: a business of any size that suffers a breach can find itself treated far more strictly. Stripe's guide to PCI DSS compliance walks through what the standard requires and how compliance is validated and maintained.
For more on the levels and the forms that go with them, see PCI DSS levels and validation.
Your acquirer decides what you must validate
The PCI Security Standards Council says that whether an entity must comply with, or validate compliance to, one of its standards is at the discretion of the organisations that manage compliance programmes, such as a payment brand or an acquirer. In practice, a shop learns its validation duties from its acquiring bank or payment provider.
So the most useful step before opening a branch or launching a website is a conversation with each provider involved:
- Tell them what is changing and when: a new branch, an online shop, phone orders.
- Ask which questionnaire or validation they now expect, and by when.
- Ask whether anything about the new set-up, such as how the website takes payments, changes that answer.
- Write down their answers, with the date and the name of the person you spoke to.
Tills at a new branch, and QR payments
How the shop's till handles payments affects the conversation with the provider, so it helps to know exactly what Achekam's till does.
Several tills, one numbering. Several tills can run at once, each opened at one of the business's stock locations, and the server hands out receipt numbers so two tills never share one. A new branch is another stock location with its own tills, and its sales sit alongside the first shop's. Setting up the branch itself is covered in opening a second shop.
Card machines are separate. A card payment at the till is recorded by the cashier from the bank terminal's slip, because the till is not connected to any card machine. The terminals at the new branch are the card provider's equipment, and questions about them go to that provider.
QR code payments. A customer can pay at the till by scanning a QR code for a pay page of a payment gateway the business has set up, and the payment counts only after the server has confirmed it with the gateway. Which gateways are offered depends on the till's currency and on the gateways the business has set up and switched on. If you add QR payments at the new branch, include that gateway in your conversation about validation, just as you would an online shop. Orders taken online without a full storefront are covered in online orders without a storefront.
Before the new branch opens or the website goes live, list every way the business will take card payments, and send that list to your acquirer with a request to confirm what validation they now require.
General guidance only, not advice on your own circumstances. Tax and payroll rules change: check the current position with the authority or your adviser.
